vaseboot/VasEBoot-core/kern/efi/tpm.c

#include <VasEBoot/err.h>
#include <VasEBoot/i18n.h>
#include <VasEBoot/efi/api.h>
#include <VasEBoot/efi/efi.h>
#include <VasEBoot/efi/tpm.h>
#include <VasEBoot/mm.h>
#include <VasEBoot/tpm.h>
#include <VasEBoot/term.h>

static VasEBoot_efi_guid_t tpm_guid = EFI_TPM_GUID;
static VasEBoot_efi_guid_t tpm2_guid = EFI_TPM2_GUID;

static VasEBoot_efi_boolean_t VasEBoot_tpm_present(VasEBoot_efi_tpm_protocol_t *tpm)
{
  VasEBoot_efi_status_t status;
  TCG_EFI_BOOT_SERVICE_CAPABILITY caps;
  VasEBoot_uint32_t flags;
  VasEBoot_efi_physical_address_t eventlog, lastevent;

  caps.Size = (VasEBoot_uint8_t)sizeof(caps);

  status = efi_call_5(tpm->status_check, tpm, &caps, &flags, &eventlog,
		      &lastevent);

  if (status != VasEBoot_EFI_SUCCESS || caps.TPMDeactivatedFlag
      || !caps.TPMPresentFlag)
    return 0;

  return 1;
}

static VasEBoot_efi_boolean_t VasEBoot_tpm2_present(VasEBoot_efi_tpm2_protocol_t *tpm)
{
  VasEBoot_efi_status_t status;
  EFI_TCG2_BOOT_SERVICE_CAPABILITY caps;

  caps.Size = (VasEBoot_uint8_t)sizeof(caps);

  status = efi_call_2(tpm->get_capability, tpm, &caps);

  if (status != VasEBoot_EFI_SUCCESS || !caps.TPMPresentFlag)
    return 0;

  return 1;
}

static VasEBoot_efi_boolean_t VasEBoot_tpm_handle_find(VasEBoot_efi_handle_t *tpm_handle,
					       VasEBoot_efi_uint8_t *protocol_version)
{
  VasEBoot_efi_handle_t *handles;
  VasEBoot_efi_uintn_t num_handles;

  handles = VasEBoot_efi_locate_handle (VasEBoot_EFI_BY_PROTOCOL, &tpm_guid, NULL,
				    &num_handles);
  if (handles && num_handles > 0) {
    *tpm_handle = handles[0];
    *protocol_version = 1;
    return 1;
  }

  handles = VasEBoot_efi_locate_handle (VasEBoot_EFI_BY_PROTOCOL, &tpm2_guid, NULL,
				    &num_handles);
  if (handles && num_handles > 0) {
    *tpm_handle = handles[0];
    *protocol_version = 2;
    return 1;
  }

  return 0;
}

static VasEBoot_err_t
VasEBoot_tpm1_execute(VasEBoot_efi_handle_t tpm_handle,
		  PassThroughToTPM_InputParamBlock *inbuf,
		  PassThroughToTPM_OutputParamBlock *outbuf)
{
  VasEBoot_efi_status_t status;
  VasEBoot_efi_tpm_protocol_t *tpm;
  VasEBoot_uint32_t inhdrsize = sizeof(*inbuf) - sizeof(inbuf->TPMOperandIn);
  VasEBoot_uint32_t outhdrsize = sizeof(*outbuf) - sizeof(outbuf->TPMOperandOut);

  tpm = VasEBoot_efi_open_protocol (tpm_handle, &tpm_guid,
				VasEBoot_EFI_OPEN_PROTOCOL_GET_PROTOCOL);

  if (!VasEBoot_tpm_present(tpm))
    return 0;

  /* UEFI TPM protocol takes the raw operand block, no param block header */
  status = efi_call_5 (tpm->pass_through_to_tpm, tpm,
		       inbuf->IPBLength - inhdrsize, inbuf->TPMOperandIn,
		       outbuf->OPBLength - outhdrsize, outbuf->TPMOperandOut);

  switch (status) {
  case VasEBoot_EFI_SUCCESS:
    return 0;
  case VasEBoot_EFI_DEVICE_ERROR:
    return VasEBoot_error (VasEBoot_ERR_IO, N_("Command failed"));
  case VasEBoot_EFI_INVALID_PARAMETER:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
  case VasEBoot_EFI_BUFFER_TOO_SMALL:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
  case VasEBoot_EFI_NOT_FOUND:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
  default:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
  }
}

static VasEBoot_err_t
VasEBoot_tpm2_execute(VasEBoot_efi_handle_t tpm_handle,
		  PassThroughToTPM_InputParamBlock *inbuf,
		  PassThroughToTPM_OutputParamBlock *outbuf)
{
  VasEBoot_efi_status_t status;
  VasEBoot_efi_tpm2_protocol_t *tpm;
  VasEBoot_uint32_t inhdrsize = sizeof(*inbuf) - sizeof(inbuf->TPMOperandIn);
  VasEBoot_uint32_t outhdrsize = sizeof(*outbuf) - sizeof(outbuf->TPMOperandOut);

  tpm = VasEBoot_efi_open_protocol (tpm_handle, &tpm2_guid,
				VasEBoot_EFI_OPEN_PROTOCOL_GET_PROTOCOL);

  if (!VasEBoot_tpm2_present(tpm))
    return 0;

  /* UEFI TPM protocol takes the raw operand block, no param block header */
  status = efi_call_5 (tpm->submit_command, tpm,
		       inbuf->IPBLength - inhdrsize, inbuf->TPMOperandIn,
		       outbuf->OPBLength - outhdrsize, outbuf->TPMOperandOut);

  switch (status) {
  case VasEBoot_EFI_SUCCESS:
    return 0;
  case VasEBoot_EFI_DEVICE_ERROR:
    return VasEBoot_error (VasEBoot_ERR_IO, N_("Command failed"));
  case VasEBoot_EFI_INVALID_PARAMETER:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
  case VasEBoot_EFI_BUFFER_TOO_SMALL:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
  case VasEBoot_EFI_NOT_FOUND:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
  default:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
  }
}

VasEBoot_err_t
VasEBoot_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
		 PassThroughToTPM_OutputParamBlock *outbuf)
{
  VasEBoot_efi_handle_t tpm_handle;
   VasEBoot_uint8_t protocol_version;

  /* It's not a hard failure for there to be no TPM */
  if (!VasEBoot_tpm_handle_find(&tpm_handle, &protocol_version))
    return 0;

  if (protocol_version == 1) {
    return VasEBoot_tpm1_execute(tpm_handle, inbuf, outbuf);
  } else {
    return VasEBoot_tpm2_execute(tpm_handle, inbuf, outbuf);
  }
}

static VasEBoot_err_t
VasEBoot_tpm1_log_event(VasEBoot_efi_handle_t tpm_handle, unsigned char *buf,
		    VasEBoot_size_t size, VasEBoot_uint8_t pcr,
		    const char *description)
{
  TCG_PCR_EVENT *event;
  VasEBoot_efi_status_t status;
  VasEBoot_efi_tpm_protocol_t *tpm;
  VasEBoot_efi_physical_address_t lastevent;
  VasEBoot_uint32_t algorithm;
  VasEBoot_uint32_t eventnum = 0;

  tpm = VasEBoot_efi_open_protocol (tpm_handle, &tpm_guid,
				VasEBoot_EFI_OPEN_PROTOCOL_GET_PROTOCOL);

  if (!VasEBoot_tpm_present(tpm))
    return 0;

  event = VasEBoot_zalloc(sizeof (TCG_PCR_EVENT) + VasEBoot_strlen(description) + 1);
  if (!event)
    return VasEBoot_error (VasEBoot_ERR_OUT_OF_MEMORY,
		       N_("cannot allocate TPM event buffer"));

  event->PCRIndex  = pcr;
  event->EventType = EV_IPL;
  event->EventSize = VasEBoot_strlen(description) + 1;
  VasEBoot_memcpy(event->Event, description, event->EventSize);

  algorithm = TCG_ALG_SHA;
  status = efi_call_7 (tpm->log_extend_event, tpm, (VasEBoot_efi_physical_address_t)buf, (VasEBoot_uint64_t) size,
		       algorithm, event, &eventnum, &lastevent);

  switch (status) {
  case VasEBoot_EFI_SUCCESS:
    return 0;
  case VasEBoot_EFI_DEVICE_ERROR:
    return VasEBoot_error (VasEBoot_ERR_IO, N_("Command failed"));
  case VasEBoot_EFI_INVALID_PARAMETER:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
  case VasEBoot_EFI_BUFFER_TOO_SMALL:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
  case VasEBoot_EFI_NOT_FOUND:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
  default:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
  }
}

static VasEBoot_err_t
VasEBoot_tpm2_log_event(VasEBoot_efi_handle_t tpm_handle, unsigned char *buf,
		   VasEBoot_size_t size, VasEBoot_uint8_t pcr,
		   const char *description)
{
  EFI_TCG2_EVENT *event;
  VasEBoot_efi_status_t status;
  VasEBoot_efi_tpm2_protocol_t *tpm;

  tpm = VasEBoot_efi_open_protocol (tpm_handle, &tpm2_guid,
				VasEBoot_EFI_OPEN_PROTOCOL_GET_PROTOCOL);

  if (!VasEBoot_tpm2_present(tpm))
    return 0;

  event = VasEBoot_zalloc(sizeof (EFI_TCG2_EVENT) + VasEBoot_strlen(description) + 1);
  if (!event)
    return VasEBoot_error (VasEBoot_ERR_OUT_OF_MEMORY,
		       N_("cannot allocate TPM event buffer"));

  event->Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER);
  event->Header.HeaderVersion = 1;
  event->Header.PCRIndex = pcr;
  event->Header.EventType = EV_IPL;
  event->Size = sizeof(*event) - sizeof(event->Event) + VasEBoot_strlen(description) + 1;
  VasEBoot_memcpy(event->Event, description, VasEBoot_strlen(description) + 1);

  status = efi_call_5 (tpm->hash_log_extend_event, tpm, 0, (VasEBoot_efi_physical_address_t)buf,
		       (VasEBoot_uint64_t) size, event);

  switch (status) {
  case VasEBoot_EFI_SUCCESS:
    return 0;
  case VasEBoot_EFI_DEVICE_ERROR:
    return VasEBoot_error (VasEBoot_ERR_IO, N_("Command failed"));
  case VasEBoot_EFI_INVALID_PARAMETER:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Invalid parameter"));
  case VasEBoot_EFI_BUFFER_TOO_SMALL:
    return VasEBoot_error (VasEBoot_ERR_BAD_ARGUMENT, N_("Output buffer too small"));
  case VasEBoot_EFI_NOT_FOUND:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("TPM unavailable"));
  default:
    return VasEBoot_error (VasEBoot_ERR_UNKNOWN_DEVICE, N_("Unknown TPM error"));
  }
}

VasEBoot_err_t
VasEBoot_tpm_log_event(unsigned char *buf, VasEBoot_size_t size, VasEBoot_uint8_t pcr,
		   const char *description)
{
  VasEBoot_efi_handle_t tpm_handle;
  VasEBoot_efi_uint8_t protocol_version;

  if (!VasEBoot_tpm_handle_find(&tpm_handle, &protocol_version))
    return 0;

  if (protocol_version == 1) {
    return VasEBoot_tpm1_log_event(tpm_handle, buf, size, pcr, description);
  } else {
    return VasEBoot_tpm2_log_event(tpm_handle, buf, size, pcr, description);
  }
}